Samsung Watch ACTIVE2 Plugin vulnerabilities

2 CVEs affecting Samsung Watch ACTIVE2 Plugin, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-25829, published 2022-03-10.

More from Samsung.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-25423, published 2021-06-11. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Improper log management vulnerability in Watch Active2 PlugIn prior to 2.2.08.21033151 version allows attacker with log permissions to leak Wi-Fi password connected to the user smartphone via log.
• CVE-2022-25829, published 2022-03-10. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. Information Exposure vulnerability in Watch Active2 Plugin prior to version 2.2.08.22012751 allows attacker to access password information of connected WiFiAp in the log